Security testing in SOA world